Privacy Policy
The short version. IncogSnap has no accounts and does not ask for your name, email or phone number. Your messages and photos go directly from your phone to your friend’s phone and are not stored on our servers. The free app shows Google AdMob ads, which use device identifiers as described in section 4.
1. Who we are
“IncogSnap”, “we”, “us” and “our” refer to the team that publishes the IncogSnap app. You can reach us at contact@bzotech.com.
2. Information we do not collect
- We do not require or collect your name, email address, phone number, social media accounts or any other account information — there are no user accounts.
- We do not receive or store the content of your messages or photos.
- We do not access your contacts, location or photo Gallery. The camera and microphone are used only as described in section 3.3.
- We do not receive your biometric data. Fingerprint / Face ID checks for App Lock are performed by your device’s operating system.
3. Information processed to make the app work
3.1 Room codes and connection setup
When you create a room, the app generates a random 6-digit code (also shown as a QR code and invite link) and stores a temporary connection offer under that code in Google Firebase Realtime Database. When a friend joins, they write back a connection answer and the apps exchange network candidates (technical connection information that can include IP addresses) through the same record. This data exists only so the two phones can find each other. It is deleted immediately once the peer-to-peer connection is established, or automatically after 10 minutes if nobody joins. Firebase is operated by Google, which may process technical logs (such as request IP addresses) under its own terms.
3.2 Messages and photos
Once connected, messages, photos and video are sent directly between the devices in the room over a WebRTC connection, which is encrypted in transit. IncogSnap adds its own end-to-end encryption on top (X25519 key exchange and XSalsa20-Poly1305 authenticated encryption, implemented with the open-source TweetNaCl library), so only the devices in the room can read the content. A fresh key pair is created for every session and exists only in your device’s memory. In a group room (up to 6 people), every pair of devices has its own independent encrypted channel — there is no shared group key. Content does not pass through or get stored on IncogSnap servers. To connect through some networks, WebRTC may use STUN or TURN relay services; a relay can see network addresses and encrypted traffic but not the content. Messages and photos self-destruct after they are viewed and are deleted when the chat ends.
3.3 Camera, microphone and temporary files
The app requests camera permission so you can take photos and record video clips (up to 15 seconds), and microphone permission so you can record clips with sound and make video calls. They are used only while you are using those features. Video calls (available in 2-person rooms) go directly to the other person and are not recorded or stored by us. Photos and video clips are written to a temporary cache inside the app (never to your Gallery). Temporary files are overwritten with zeros and then deleted when you leave the screen or end the session.
3.4 Gemini AI enhancement (optional, bring your own key)
If you choose to use AI photo enhancement, you provide your own Google Gemini API key. The key is stored encrypted on your device (Android Keystore / iOS Keychain) and is never sent to us. When you enhance a photo, the app sends that photo from your device directly to Google’s Gemini API using your key. Google’s handling of that data is governed by the Google Privacy Policy and the Gemini API terms that apply to your key. If you do not want this, simply do not enable the feature.
3.5 On-device settings
The app stores preferences such as your language and App Lock setting on your device. It also keeps a room log in the Rooms tab — the room code, the time and how the session ended — but never message or photo content. This information stays on your device.
3.6 Reports you send us
If you use Report a problem in the app or email us to report abuse or a safety concern, we receive the details you choose to submit, such as the time of the incident, the room code and your description, together with the email address you write from. Because chats are end-to-end encrypted, we cannot read message content ourselves. We use this information only to investigate the report, to take action under our Terms, and to cooperate with law enforcement or child-protection organisations where the law requires or allows.
4. Advertising (Google AdMob)
The free version of IncogSnap shows ads served by Google AdMob:
- Banner ads on the home, create-room and join-room screens;
- Full-screen (interstitial) ads while you wait for someone to join a room and when a chat ends, with a cooldown so they do not appear back to back;
- App-open ads when you return to the app from the background, at most once every 4 hours;
- Rewarded ads that you choose to watch (for example from Settings) in exchange for a reward, such as unlocking extra AI enhancement styles (“AI Pro”) for 24 hours.
Ads are never shown while you are chatting or taking photos.
To serve and measure ads, prevent fraud and comply with law, Google AdMob may collect and use information such as your device’s advertising identifier, IP address, device and app information, and how you interact with ads. Where required (for example in the EEA and UK), we ask for your consent before personalized ads are shown. You can reset or opt out of the advertising ID in your device settings (Android: Settings → Privacy → Ads; iOS: Settings → Privacy & Security → Tracking). Learn more in How Google uses information from sites or apps that use its services.
5. How information is shared
We do not sell your personal information. Information is processed by the service providers described above: Google (Firebase Realtime Database, Google AdMob and, if you enable it, the Gemini API). Because we do not hold message content or account data, we have nothing about your conversations to disclose in response to a legal request beyond what is described in this policy.
6. Retention
- Room / connection data: deleted once connected, or after 10 minutes at most.
- Messages, photos and video: exist only on the devices in the room during the chat and are deleted when it ends.
- Reports you send us: kept only as long as needed to investigate the report and meet our legal obligations.
- Temporary files: overwritten and deleted when you leave the screen or end the session.
- Gemini API key, room log and settings: kept on your device until you remove them, clear the app’s data or uninstall the app.
7. Security
We use end-to-end encrypted peer-to-peer connections, secure hardware-backed storage for your API key, screenshot and screen-recording protection, optional biometric App Lock and a Panic Exit feature. No system is perfectly secure, and content shown on a screen can still be photographed by another device, so please share responsibly.
8. Children
IncogSnap is intended only for people aged 17 and over and is not directed to children. We do not knowingly collect personal information from anyone under 13 (or the minimum age in your country), and we do not allow people under 17 to use the app. If you believe a minor has used the app, contact us at contact@bzotech.com. See also our Child Safety Standards.
9. Your rights and choices
Because IncogSnap does not maintain accounts or store data that identifies you, there is generally no personal profile for us to access, correct or delete. You control your data on your device: see Account & Data Deletion. Depending on where you live (for example the EEA, UK or California), you may have rights to access, delete or object to the processing of personal data held by us or by our providers. Contact us and we will help; for data held by Google (for example ad-related data), you can also use Google’s privacy controls.
10. International processing
Our service providers (such as Google) may process data in countries other than your own. Where required, they rely on appropriate safeguards for international transfers.
11. Changes to this policy
We may update this policy from time to time. The effective date at the top shows when it was last changed. Material changes will be reflected here and, where appropriate, in the app.
12. Contact
Questions or requests about privacy: contact@bzotech.com.